Task Statement 2.3: Identify AWS Access Management Capabilities. CLF-C02 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary purpose of creating an IAM user in AWS?

   • ATo create a boundary that limits the maximum permissions for an account
   • BTo provide temporary credentials for a service to access another AWS service
   • CTo define a set of permissions that can be attached to multiple users
   • DTo represent a person or application that requires long-term access to AWS resources
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the purpose of a service control policy (SCP) in AWS Organizations?

   • ATo manage the billing for all accounts in the organization
   • BTo create new AWS accounts within an organization
   • CTo provide single sign-on for users across multiple accounts
   • DTo centrally control the maximum permissions that can be granted to IAM principals in member accounts
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company is using AWS Organizations and wants to provide its employees with a single sign-on experience to access multiple AWS accounts and third-party SaaS applications. Which AWS service should the company use?

   • AAWS Organizations
   • BAWS Directory Service
   • CAWS Single Sign-On (legacy)
   • DAWS IAM Identity Center
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which AWS Identity and Access Management (IAM) construct is used to grant the same set of permissions to multiple users at once?

   • AAn IAM policy
   • BAn IAM group
   • CAn IAM role
   • DAn IAM user
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company's security policy requires that all IAM users must provide a second form of authentication when signing in to the AWS Management Console. The company wants to enforce this requirement centrally so that users cannot sign in without it. Which of the following is the MOST effective way to enforce this policy?

   • AUse AWS Organizations to apply a service control policy (SCP) that requires MFA for all users in the organization.
   • BCreate an IAM policy that denies all actions unless MFA is present, and attach it to all IAM users or groups.
   • CEnable MFA on each IAM user's account and instruct them to use a virtual MFA device.
   • DConfigure the AWS account's password policy to require MFA.
   Reveal Solution Discussion Select an answer first